Charlie Somerville discovered that Ruby incorrectly handled floatingpoint number conversion. If an application using Ruby accepted untrustedinput strings and converted them to floating point numbers, an attackerable to provide such input could cause the application to crash or,possibly, execute arbitrary code with the privileges of the application.

For the oldstable distribution (squeeze), this problem has been fixed inversion 1.9.2.0-2+deb6u2.

For the stable distribution (wheezy), this problem has been fixed inversion 1.9.3.194-8.1+deb7u2.

For the unstable distribution (sid), this problem has been fixed inversion 1.9.3.484-1.

We recommend that you upgrade your ruby1.9.1 packages.

Further information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: http://www.debian.org/security/

Several vulnerabilities have been discovered in the interpreter for theRuby language. The Common Vulnerabilities and Exposures projectidentifies the following problems:

CVE-2013-1821

Ben Murphy discovered that unrestricted entity expansion in REXML can lead to a Denial of Service by consuming all host memory.

CVE-2013-4073

William (B.J.) Snow Orvis discovered a vulnerability in the hostname checking in Ruby's SSL client that could allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate issued by a trusted certification authority.

CVE-2013-4164

Charlie Somerville discovered that Ruby incorrectly handled floating point number conversion. If an application using Ruby accepted untrusted input strings and converted them to floating point numbers, an attacker able to provide such input could cause the application to crash or, possibly, execute arbitrary code with the privileges of the application.

For the oldstable distribution (squeeze), these problems have been fixed inversion 1.8.7.302-2squeeze2.

For the stable distribution (wheezy), these problems have been fixed inversion 1.8.7.358-7.1+deb7u1.

For the unstable distribution (sid), these problems have been fixed inversion 1.8.7.358-9.

We recommend that you upgrade your ruby1.8 packages.

Further information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: http://www.debian.org/security/